<!DOCTYPE HTML>
<html lang="zh-CN">


<head>
    <meta charset="utf-8">
    <meta name="keywords" content="关于Tom表哥对卖手机的骗子网站的一不小心的分析, 飞畅">
    <meta name="description" content="逛bilibili,发现了大表哥一不小心就进了某个骗子网站的后台,不仅心向往之...为了有朝一日我也能够像表哥一样,我决定动手分析一波">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
    <meta name="renderer" content="webkit|ie-stand|ie-comp">
    <meta name="mobile-web-app-capable" content="yes">
    <meta name="format-detection" content="telephone=no">
    <meta name="apple-mobile-web-app-capable" content="yes">
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
    <title>关于Tom表哥对卖手机的骗子网站的一不小心的分析 | 飞畅</title>
    <link rel="icon" type="image/png" href="/blog/pika.png">

    <link rel="stylesheet" type="text/css" href="/blog/libs/awesome/css/all.css">
    <link rel="stylesheet" type="text/css" href="/blog/libs/materialize/materialize.min.css">
    <link rel="stylesheet" type="text/css" href="/blog/libs/aos/aos.css">
    <link rel="stylesheet" type="text/css" href="/blog/libs/animate/animate.min.css">
    <link rel="stylesheet" type="text/css" href="/blog/libs/lightGallery/css/lightgallery.min.css">
    <link rel="stylesheet" type="text/css" href="/blog/css/matery.css">
    <link rel="stylesheet" type="text/css" href="/blog/css/my.css">
    
    <script src="/blog/libs/jquery/jquery.min.js"></script>
    
<meta name="generator" content="Hexo 4.2.0"><link rel="stylesheet" href="/blog/css/prism-okaidia.css" type="text/css"></head>


<body>
    <header class="navbar-fixed">
    <nav id="headNav" class="bg-color nav-transparent">
        <div id="navContainer" class="nav-wrapper head-container">
            <div class="brand-logo">
                <a href="/blog/" class="waves-effect waves-light">
                    
                    <img src="/blog/medias/pika.png" class="logo-img" alt="LOGO">
                    
                    <span class="logo-span">飞畅</span>
                </a>
            </div>
            

<a href="#" data-target="mobile-nav" class="sidenav-trigger button-collapse"><i class="fas fa-bars"></i></a>
<ul class="right nav-menu">
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/blog/" class="waves-effect waves-light">
      
      <i class="fas fa-home" style="zoom: 0.6;"></i>
      
      <span>首页</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/blog/tags" class="waves-effect waves-light">
      
      <i class="fas fa-tags" style="zoom: 0.6;"></i>
      
      <span>标签</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/blog/categories" class="waves-effect waves-light">
      
      <i class="fas fa-bookmark" style="zoom: 0.6;"></i>
      
      <span>分类</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/blog/archives" class="waves-effect waves-light">
      
      <i class="fas fa-archive" style="zoom: 0.6;"></i>
      
      <span>归档</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/blog/about" class="waves-effect waves-light">
      
      <i class="fas fa-user-circle" style="zoom: 0.6;"></i>
      
      <span>关于</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/blog/contact" class="waves-effect waves-light">
      
      <i class="fas fa-comments" style="zoom: 0.6;"></i>
      
      <span>留言板</span>
    </a>
    
  </li>
  
  <li class="hide-on-med-and-down nav-item">
    
    <a href="/blog/friends" class="waves-effect waves-light">
      
      <i class="fas fa-address-book" style="zoom: 0.6;"></i>
      
      <span>友情链接</span>
    </a>
    
  </li>
  
  <li>
    <a href="#searchModal" class="modal-trigger waves-effect waves-light">
      <i id="searchIcon" class="fas fa-search" title="搜索" style="zoom: 0.85;"></i>
    </a>
  </li>
</ul>

<div id="mobile-nav" class="side-nav sidenav">

    <div class="mobile-head bg-color">
        
        <img src="/blog/medias/pika.png" class="logo-img circle responsive-img">
        
        <div class="logo-name">飞畅</div>
        <div class="logo-desc">
            
            Never really desperate, only the lost of the soul.
            
        </div>
    </div>

    

    <ul class="menu-list mobile-menu-list">
        
        <li class="m-nav-item">
	  
		<a href="/blog/" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-home"></i>
			
			首页
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/blog/tags" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-tags"></i>
			
			标签
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/blog/categories" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-bookmark"></i>
			
			分类
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/blog/archives" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-archive"></i>
			
			归档
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/blog/about" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-user-circle"></i>
			
			关于
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/blog/contact" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-comments"></i>
			
			Contact
		</a>
          
        </li>
        
        <li class="m-nav-item">
	  
		<a href="/blog/friends" class="waves-effect waves-light">
			
			    <i class="fa-fw fas fa-address-book"></i>
			
			友情链接
		</a>
          
        </li>
        
        
    </ul>
</div>

        </div>

        
    </nav>

</header>

    



<div class="bg-cover pd-header post-cover" style="background-image: url('/blog/medias/featureimages/6.jpg')">
    <div class="container" style="right: 0px;left: 0px;">
        <div class="row">
            <div class="col s12 m12 l12">
                <div class="brand">
                    <h1 class="description center-align post-title">关于Tom表哥对卖手机的骗子网站的一不小心的分析</h1>
                </div>
            </div>
        </div>
    </div>
</div>




<main class="post-container content">

    
    <link rel="stylesheet" href="/blog/libs/tocbot/tocbot.css">
<style>
    #articleContent h1::before,
    #articleContent h2::before,
    #articleContent h3::before,
    #articleContent h4::before,
    #articleContent h5::before,
    #articleContent h6::before {
        display: block;
        content: " ";
        height: 100px;
        margin-top: -100px;
        visibility: hidden;
    }

    #articleContent :focus {
        outline: none;
    }

    .toc-fixed {
        position: fixed;
        top: 64px;
    }

    .toc-widget {
        width: 345px;
        padding-left: 20px;
    }

    .toc-widget .toc-title {
        margin: 35px 0 15px 0;
        padding-left: 17px;
        font-size: 1.5rem;
        font-weight: bold;
        line-height: 1.5rem;
    }

    .toc-widget ol {
        padding: 0;
        list-style: none;
    }

    #toc-content {
        height: calc(100vh - 250px);
        overflow: auto;
    }

    #toc-content ol {
        padding-left: 10px;
    }

    #toc-content ol li {
        padding-left: 10px;
    }

    #toc-content .toc-link:hover {
        color: #42b983;
        font-weight: 700;
        text-decoration: underline;
    }

    #toc-content .toc-link::before {
        background-color: transparent;
        max-height: 25px;
    }

    #toc-content .is-active-link {
        color: #42b983;
    }

    #toc-content .is-active-link::before {
        background-color: #42b983;
    }

    #floating-toc-btn {
        position: fixed;
        right: 15px;
        bottom: 76px;
        padding-top: 15px;
        margin-bottom: 0;
        z-index: 998;
    }

    #floating-toc-btn .btn-floating {
        width: 48px;
        height: 48px;
    }

    #floating-toc-btn .btn-floating i {
        line-height: 48px;
        font-size: 1.4rem;
    }
</style>
<div class="row">
    <div id="main-content" class="col s12 m12 l9">
        <!-- 文章内容详情 -->
<div id="artDetail">
    <div class="card">
        <div class="card-content article-info">
            <div class="row tag-cate">
                <div class="col s7">
                    
                    <div class="article-tag">
                        
                            <a href="/blog/tags/shopxo/">
                                <span class="chip tag-color">shopxo</span>
                            </a>
                        
                            <a href="/blog/tags/mysql/">
                                <span class="chip tag-color">mysql</span>
                            </a>
                        
                            <a href="/blog/tags/thinkphp5/">
                                <span class="chip tag-color">thinkphp5</span>
                            </a>
                        
                    </div>
                    
                </div>
                <div class="col s5 right-align">
                    
                    <div class="post-cate">
                        <i class="fas fa-bookmark fa-fw icon-category"></i>
                        
                            <a href="/blog/categories/Web/" class="post-category">
                                Web
                            </a>
                        
                    </div>
                    
                </div>
            </div>

            <div class="post-info">
                
                <div class="post-date info-break-policy">
                    <i class="far fa-calendar-minus fa-fw"></i>发布日期:&nbsp;&nbsp;
                    2020-04-04
                </div>
                

                

                
                <div class="info-break-policy">
                    <i class="far fa-file-word fa-fw"></i>文章字数:&nbsp;&nbsp;
                    1.7k
                </div>
                

                
                <div class="info-break-policy">
                    <i class="far fa-clock fa-fw"></i>阅读时长:&nbsp;&nbsp;
                    6 分
                </div>
                
				
                
                    <div id="busuanzi_container_page_pv" class="info-break-policy">
                        <i class="far fa-eye fa-fw"></i>阅读次数:&nbsp;&nbsp;
                        <span id="busuanzi_value_page_pv"></span>
                    </div>
				
            </div>
            
        </div>
        <hr class="clearfix">
        <div class="card-content article-card-content">
            <div id="articleContent">
                <style>
.img-item img:hover {
    transform: scale(1.3);
    transition: all 0.5s;
}
</style>


<p>一切的一切都要从一只蝙蝠开始说起……总之最近很闲,于是逛bilibili,发现了大表哥<strong>一不小心</strong>就进了某个骗子网站的后台,不仅心向往之<br>但不幸的是据说为了规避风险,表哥删减了很多内容,看的我云里雾里,一不小心就晕了<br><a href="https://www.bilibili.com/video/av86936155?from=search&seid=11978508919224284418" target="_blank" rel="noopener">Tom表哥的视频在这里</a><br>为了有朝一日我也能够像表哥一样<strong>一不小心</strong>,我决定动手分析一波</p>
<h1 id="进后台"><a href="#进后台" class="headerlink" title="进后台"></a>进后台</h1><p>放一张视频截图<br><img src="/blog/2020/04/04/%E9%AA%97%E5%AD%90%E7%BD%91%E7%AB%99%E7%9A%84%E5%88%86%E6%9E%90/%E6%97%A5%E5%BF%97.jpg" alt="视频截图"></p>
<p>可以看到表哥用的是<strong>burpsuite</strong>爆破日志,然后知道管理员密码进了后台</p>
<p>网站是由基于<code>thinkphp5</code>开发的<code>shopxo1.6</code>(或许可以试试<code>thinkphp5</code>的几个<a href="https://blog.csdn.net/weixin_40709439/article/details/86564457" target="_blank" rel="noopener">poc</a>,下次一定吧),去<a href="https://ask.shopxo.net/article/1" target="_blank" rel="noopener">官网</a>上下载源码安装后,知道了默认的管理员账户为<strong>admin</strong>,<strong>shopxo</strong>,但我肯定现在不会有人使用默认的密码了,毕竟谁没有被盗过QQ号呢?啊!我逝去的青春..</p>
<p>表哥说的日志位于<code>/runtime/log/</code>(省略网站根目录前缀,下同)下的目录中,不同的目录命名格式应该是4位的年份加上2位的月份,然后对应月份的目录下是文件名为2位的日,后缀为<strong>log</strong>的文本文档</p>
<p><img src="/blog/2020/04/04/%E9%AA%97%E5%AD%90%E7%BD%91%E7%AB%99%E7%9A%84%E5%88%86%E6%9E%90/Snipaste_2020-02-08_22-02-50.png" alt="日志"></p>
<p>因为只需要关心最近一个或两个月内管理员的登录行为(太靠前或许密码被改掉了,以及日志或许被清掉了),所以目录是直接可以确定的</p>
<p>于是通过burp suite的intruder进行对2位日子的遍历,然后根据大小排序得到信息相对较多,更可能是有登录行为的文件</p>
<p>搜索<code>pwd</code>字符串是因为管理员登录时post的密码变量名为<code>login_pwd</code>,然后发现确实有对数据库中<code>s_admin</code>表中<code>username</code>为<code>admin</code>的<code>login_salt</code>和<code>login_pwd</code>进行查询,而且登录后会对数据表中的<code>login_salt</code>和<code>login_pwd</code>进行更新</p>
<p><img src="/blog/2020/04/04/%E9%AA%97%E5%AD%90%E7%BD%91%E7%AB%99%E7%9A%84%E5%88%86%E6%9E%90/Snipaste_2020-02-08_22-15-07.png" alt="sql查询记录"></p>
<p>密码校验主要调用<code>/application/common.php</code>里的<code>LoginPwdEncryption</code>函数</p>
<pre class=" language-php"><code class="language-php"><span class="token keyword">function</span> <span class="token function">LoginPwdEncryption</span><span class="token punctuation">(</span><span class="token variable">$pwd</span><span class="token punctuation">,</span> <span class="token variable">$salt</span><span class="token punctuation">)</span>
<span class="token punctuation">{</span>
    <span class="token keyword">return</span> <span class="token function">md5</span><span class="token punctuation">(</span><span class="token variable">$salt</span><span class="token punctuation">.</span><span class="token function">trim</span><span class="token punctuation">(</span><span class="token variable">$pwd</span><span class="token punctuation">)</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span></code></pre>
<p>数据表中一直都是对密码加盐后的md5值,效验的时候将用户输入的密码同样加盐后进行对比,成功后更新数据库里的<code>login_salt</code>和<code>login_pwd</code>,也就是日志里看到的数据</p>
<pre class=" language-php"><code class="language-php"><span class="token comment" spellcheck="true">// 密码校验</span>
<span class="token variable">$login_pwd</span> <span class="token operator">=</span> <span class="token function">LoginPwdEncryption</span><span class="token punctuation">(</span><span class="token variable">$params</span><span class="token punctuation">[</span><span class="token string">'login_pwd'</span><span class="token punctuation">]</span><span class="token punctuation">,</span> <span class="token variable">$admin</span><span class="token punctuation">[</span><span class="token string">'login_salt'</span><span class="token punctuation">]</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token keyword">if</span><span class="token punctuation">(</span><span class="token variable">$login_pwd</span> <span class="token operator">!=</span> <span class="token variable">$admin</span><span class="token punctuation">[</span><span class="token string">'login_pwd'</span><span class="token punctuation">]</span><span class="token punctuation">)</span>
<span class="token punctuation">{</span>
    <span class="token keyword">return</span> <span class="token function">DataReturn</span><span class="token punctuation">(</span><span class="token string">'密码错误'</span><span class="token punctuation">,</span> <span class="token operator">-</span><span class="token number">3</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span></code></pre>
<p>那么我们可以借助<a href="https://www.cmd5.com/" target="_blank" rel="noopener">md5解析</a>的网站对<code>login_pwd</code>进行破解,但我试了试因为是随机加盐,问题很大</p>
<p>也可以自己进行暴力破解,程序很好写,但这个6-18位密码遍历起来太耗时,最多试试6-9的遍历</p>
<p>万幸的是,表哥遇到的环境里应该是开启了调试模式,也就是将<code>/config/app.php</code>里的<code>app_debug</code>设为<code>true</code>,日志里除了数据库的信息外还会开启info级别记录,然后我们重新登录后搜索<code>pwd</code>的时候我们就可以看到用户post的数据了,其中<code>login_pwd</code>项是明文的密码</p>
<p><img src="/blog/2020/04/04/%E9%AA%97%E5%AD%90%E7%BD%91%E7%AB%99%E7%9A%84%E5%88%86%E6%9E%90/Snipaste_2020-02-08_22-18-53.png" alt="明文记录"></p>
<p>进入后台get</p>
<h1 id="getshell"><a href="#getshell" class="headerlink" title="getshell"></a>getshell</h1><p>后续上传一句话getshell,如果mysql的<strong>SECURE_FILE_PRIV</strong>不是<strong>NULL</strong>的话,那就直接在<code>工具-&gt;SQL控制台</code>里执行<code>select into outfile</code>一气呵成</p>
<p><del>不行的话不知道咋办了,或许是这个<a href="https://www.cnvd.org.cn/patchInfo/show/191531" target="_blank" rel="noopener">CNVD-2019-47173</a>(未公布poc),或许是ueditor有上传漏洞(懒得试了),求知道的大佬告知<br>放一张图假装自己getshell</del><br><img src="https://img-blog.csdnimg.cn/2020020822332931.jpg?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaWNoYW5nMg==,size_16,color_FFFFFF,t_0" alt="shellget!"></p>
<h2 id="安装主题getshell"><a href="#安装主题getshell" class="headerlink" title="安装主题getshell"></a>安装主题getshell</h2><p>参考路西法大哥的<a href="http://www.downangel.com/index.php/archives/99/" target="_blank" rel="noopener">ShopXO框架后台Getshell漏洞复现</a>,成功从后台getshell</p>
<p>步骤:<br>首先,到后台<code>应用管理-&gt;应用商店-&gt;主题</code>,去下载那个唯一的免费主题<br><img src="https://img-blog.csdnimg.cn/20200326001457627.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaWNoYW5nMg==,size_16,color_FFFFFF,t_0" alt><br>在这个压缩包的<code>\default\__static__</code>目录下添加一个php文件</p>
<p>去<code>网站管理-&gt;主题管理-&gt;主题安装</code>里将这个压缩包上传,添加的php文件会解压到<br><code>shopxo根目录\public\static\index\default</code>目录下,http访问这个文件即可<br><img src="https://img-blog.csdnimg.cn/20200326002554751.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZlaWNoYW5nMg==,size_16,color_FFFFFF,t_0" alt="真的shell"><br>(小声bb:我之前试了一次插件里加php文件,结果失败了,就放弃了…〒▽〒,现在认真的试了试,发现也是可以getshell的</p>
<h2 id="上传插件getshell"><a href="#上传插件getshell" class="headerlink" title="上传插件getshell"></a>上传插件getshell</h2><p>用<strong>ucenter</strong>插件举例,它的ucenter目录里的结构是这样的</p>
<pre><code>├─_controller_      
│  └─ucenter        
│      ├─admin      
│      └─index      
├─_css_             
│  └─ucenter        
│      └─admin      
├─_uploadimages_    
│  └─plugins_ucenter
│      └─2019       
│          └─04     
│              └─02 
└─_view_            
    └─ucenter       
        └─admin     
            └─admin </code></pre><p>然后呢,上传过后<br><code>_view_</code>目录会对应于<code>application\plugins\view</code>(省略了shopxo根路径,下同)<br><code>_controller_</code>目录里的<code>ucenter</code>目录会对应于<code>application\plugins\ucenter</code><br>以上两个都是禁止访问的<br><code>_css_</code>会对应于<code>public\static\plugins\css</code><br><code>_uploadimages_</code>会对应于<code>public\static\upload\images</code><br>这两个目录(及其子目录)下放php文件可以正常访问并执行</p>
<p>关于不能访问的原因:<code>application\</code>目录下存在内容为<code>deny from all</code>的<code>.htaccess</code>文件而<code>public\</code>目录下没有(除了一个对错误访问的处理)</p>
<h2 id="继续sql控制台"><a href="#继续sql控制台" class="headerlink" title="继续sql控制台"></a>继续sql控制台</h2><p>尝试了一下利用后台的自带的sql执行工具getshell</p>
<p>思路:<br>设置开启日志记录:<code>set global general_log=&#39;on&#39;;</code></p>
<p>设置日志文件位置:<code>SET global general_log_file=&#39;../../WWW/a.php&#39;;</code></p>
<p>(注:因为后台的mysql语句执行只返回是否成功,不返回结果,所以这里的的路径采用一个个尝试根据是否报错决定:比如<code>../../WWW/a.php</code>,<code>/var/www/html/a.php</code>)</p>
<p>向日志中写入payload:<code>select &#39;&lt;?php phpinfo();?&gt;&#39;;</code></p>
<p>在第三步失败,因为shopxo设置了全局的过滤函数为<strong>htmlspecialchars</strong>,会使得<code>&lt;</code>和<code>&gt;</code>被转义为<code>&amp;lt;</code>和<code>&amp;gt;</code>,<code>&quot;</code>也是的,<code>&#39;</code>单引号还可以用,而在sql查询的时候又没有还原(u1s1,这应该算是个bug,不知道作者什么时候修复(/▽＼)</p>
<p>还好,天无绝人之路</p>
<p>我们可以在后台的sql控制台中创建一个远程用户,然后直接连上去,这个时候上面的路就可以走通了</p>
<p>创建用户kali密码root任何客户端都可以连:<code>grant all privileges  on *.* to root@&#39;%&#39; identified by  &#39;kali&#39;  with grant option;</code></p>
<p><code>flush privileges;</code>:使修改生效</p>
<p>(如果失败的话:可以试试根据自己mysql客户端的报错信息建立相应的用户(比如‘kali’@’kali.cn’就可以加上一个host为’kali.cn’的用户)再刷新)</p>
<p><code>show @@datadir;</code>可以看到数据库绝对路径</p>
<p><code>show variables like &quot;%general%&quot;;</code>:查看日志情况</p>
<p>开启日志记录及设置文件位置大致同上</p>
<p><code>select &quot;&lt;?php phpinfo();?&gt;&quot;;</code></p>
<p>然后直接访问日志就可以看到熟悉的phpinfo画面了</p>
<h2 id="thinkphp5漏洞尝试"><a href="#thinkphp5漏洞尝试" class="headerlink" title="thinkphp5漏洞尝试"></a>thinkphp5漏洞尝试</h2><p>填坑关于之前提到的thinkphp的漏洞</p>
<p>我下的最新版的shopxo已经使用的是thinkphp5.1.31了</p>
<p>5.0的payload<code>?s=index/\think\app/invokefunction&amp;function=call_user_func_array&amp;vars[0]=system&amp;vars[1][]=操作系统命令</code>不能用了</p>
<p>过滤点在<code>thinkphp/library/think/route/dispatch/Url.php</code>的第63行</p>
<pre class=" language-php"><code class="language-php"><span class="token keyword">if</span> <span class="token punctuation">(</span><span class="token variable">$controller</span> <span class="token operator">&amp;&amp;</span> <span class="token operator">!</span><span class="token function">preg_match</span><span class="token punctuation">(</span><span class="token string">'/^[A-Za-z][\w|\.]*$/'</span><span class="token punctuation">,</span> <span class="token variable">$controller</span><span class="token punctuation">)</span><span class="token punctuation">)</span> <span class="token punctuation">{</span>
    <span class="token keyword">throw</span> <span class="token keyword">new</span> <span class="token class-name">HttpException</span><span class="token punctuation">(</span><span class="token number">404</span><span class="token punctuation">,</span> <span class="token string">'controller not exists:'</span> <span class="token punctuation">.</span> <span class="token variable">$controller</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token punctuation">}</span></code></pre>
<p>去年1月的那个<a href="https://blog.csdn.net/csacs/article/details/86668057" target="_blank" rel="noopener">变量覆盖的payload</a>在源码里添加<br><code>error_reporting(0);</code>后是可以的</p>
<p><img src="/blog/2020/04/04/%E9%AA%97%E5%AD%90%E7%BD%91%E7%AB%99%E7%9A%84%E5%88%86%E6%9E%90/Snipaste_2020-02-10_14-18-10.png" alt="命令执行"></p>

            </div>
            <hr/>

            

    <div class="reprint" id="reprint-statement">
        
            <div class="reprint__author">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-user">
                        文章作者:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="https://fei_chang_2.gitee.io" rel="external nofollow noreferrer">飞畅</a>
                </span>
            </div>
            <div class="reprint__type">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-link">
                        文章链接:
                    </i>
                </span>
                <span class="reprint-info">
                    <a href="https://fei_chang_2.gitee.io/blog/2020/04/04/%E9%AA%97%E5%AD%90%E7%BD%91%E7%AB%99%E7%9A%84%E5%88%86%E6%9E%90/">https://fei_chang_2.gitee.io/blog/2020/04/04/%E9%AA%97%E5%AD%90%E7%BD%91%E7%AB%99%E7%9A%84%E5%88%86%E6%9E%90/</a>
                </span>
            </div>
            <div class="reprint__notice">
                <span class="reprint-meta" style="font-weight: bold;">
                    <i class="fas fa-copyright">
                        版权声明:
                    </i>
                </span>
                <span class="reprint-info">
                    本博客所有文章除特別声明外，均采用
                    <a href="https://creativecommons.org/licenses/by/4.0/deed.zh" rel="external nofollow noreferrer" target="_blank">CC BY 4.0</a>
                    许可协议。转载请注明来源
                    <a href="https://fei_chang_2.gitee.io" target="_blank">飞畅</a>
                    !
                </span>
            </div>
        
    </div>

    <script async defer>
      document.addEventListener("copy", function (e) {
        let toastHTML = '<span>复制成功，请遵循本文的转载规则</span><button class="btn-flat toast-action" onclick="navToReprintStatement()" style="font-size: smaller">查看</a>';
        M.toast({html: toastHTML})
      });

      function navToReprintStatement() {
        $("html, body").animate({scrollTop: $("#reprint-statement").offset().top - 80}, 800);
      }
    </script>



            <div class="tag_share" style="display: block;">
                <div class="post-meta__tag-list" style="display: inline-block;">
                    
                        <div class="article-tag">
                            
                                <a href="/blog/tags/shopxo/">
                                    <span class="chip tag-color">shopxo</span>
                                </a>
                            
                                <a href="/blog/tags/mysql/">
                                    <span class="chip tag-color">mysql</span>
                                </a>
                            
                                <a href="/blog/tags/thinkphp5/">
                                    <span class="chip tag-color">thinkphp5</span>
                                </a>
                            
                        </div>
                    
                </div>
                <div class="post_share" style="zoom: 80%; width: fit-content; display: inline-block; float: right; margin: -0.15rem 0;">
                    <link rel="stylesheet" type="text/css" href="/blog/libs/share/css/share.min.css">

<div id="article-share">
    
    
    <div class="social-share" data-sites="twitter,facebook,google,qq,qzone,wechat,weibo,douban,linkedin" data-wechat-qrcode-helper="<p>微信扫一扫即可分享！</p>"></div>
    <script src="/blog/libs/share/js/social-share.min.js"></script>
    

    

</div>

                </div>
            </div>
            
        </div>
    </div>

    

    

    

    

    

    

<article id="prenext-posts" class="prev-next articles">
    <div class="row article-row">
        
        <div class="article col s12 m6" data-aos="fade-up" data-aos="fade-up">
            <div class="article-badge left-badge text-color">
                <i class="far fa-dot-circle"></i>&nbsp;本篇
            </div>
            <div class="card">
                <a href="/blog/2020/04/04/%E9%AA%97%E5%AD%90%E7%BD%91%E7%AB%99%E7%9A%84%E5%88%86%E6%9E%90/">
                    <div class="card-image">
                        
                        
                        <img src="/blog/medias/featureimages/6.jpg" class="responsive-img" alt="关于Tom表哥对卖手机的骗子网站的一不小心的分析">
                        
                        <span class="card-title">关于Tom表哥对卖手机的骗子网站的一不小心的分析</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            逛bilibili,发现了大表哥一不小心就进了某个骗子网站的后台,不仅心向往之...为了有朝一日我也能够像表哥一样,我决定动手分析一波
                        
                    </div>
                    <div class="publish-info">
                            <span class="publish-date">
                                <i class="far fa-clock fa-fw icon-date"></i>2020-04-04
                            </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-bookmark fa-fw icon-category"></i>
                            
                            <a href="/blog/categories/Web/" class="post-category">
                                    Web
                                </a>
                            
                            
                        </span>
                    </div>
                </div>

                
                <div class="card-action article-tags">
                    
                    <a href="/blog/tags/shopxo/">
                        <span class="chip tag-color">shopxo</span>
                    </a>
                    
                    <a href="/blog/tags/mysql/">
                        <span class="chip tag-color">mysql</span>
                    </a>
                    
                    <a href="/blog/tags/thinkphp5/">
                        <span class="chip tag-color">thinkphp5</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
        
        <div class="article col s12 m6" data-aos="fade-up">
            <div class="article-badge right-badge text-color">
                下一篇&nbsp;<i class="fas fa-chevron-right"></i>
            </div>
            <div class="card">
                <a href="/blog/2020/03/30/csdn%E7%A0%B4%E8%A7%A3/">
                    <div class="card-image">
                        
                        
                        <img src="/blog/medias/featureimages/15.jpg" class="responsive-img" alt="csdn网页的保存">
                        
                        <span class="card-title">csdn网页的保存</span>
                    </div>
                </a>
                <div class="card-content article-content">
                    <div class="summary block-with-text">
                        
                            csdn ctrl-s保存到本地打开会自动跳转,对我这种只有流量可以用的情况很不友好,所以开始了研究
                        
                    </div>
                    <div class="publish-info">
                            <span class="publish-date">
                                <i class="far fa-clock fa-fw icon-date"></i>2020-03-30
                            </span>
                        <span class="publish-author">
                            
                            <i class="fas fa-bookmark fa-fw icon-category"></i>
                            
                            <a href="/blog/categories/%E6%97%A5%E5%B8%B8/" class="post-category">
                                    日常
                                </a>
                            
                            
                        </span>
                    </div>
                </div>
                
                <div class="card-action article-tags">
                    
                    <a href="/blog/tags/JS/">
                        <span class="chip tag-color">JS</span>
                    </a>
                    
                    <a href="/blog/tags/csdn/">
                        <span class="chip tag-color">csdn</span>
                    </a>
                    
                </div>
                
            </div>
        </div>
        
    </div>
</article>

</div>



<!-- 代码块功能依赖 -->
<script type="text/javascript" src="/blog/libs/codeBlock/codeBlockFuction.js"></script>

<!-- 代码语言 -->

<script type="text/javascript" src="/blog/libs/codeBlock/codeLang.js"></script>

    
<!-- 代码块复制 -->

<script type="text/javascript" src="/blog/libs/codeBlock/codeCopy.js"></script>


<!-- 代码块收缩 -->

<script type="text/javascript" src="/blog/libs/codeBlock/codeShrink.js"></script>


<!-- 代码块折行 -->

<style type="text/css">
code[class*="language-"], pre[class*="language-"] { white-space: pre !important; }
</style>

    </div>
    <div id="toc-aside" class="expanded col l3 hide-on-med-and-down">
        <div class="toc-widget">
            <div class="toc-title"><i class="far fa-list-alt"></i>&nbsp;&nbsp;目录</div>
            <div id="toc-content"></div>
        </div>
    </div>
</div>

<!-- TOC 悬浮按钮. -->

<div id="floating-toc-btn" class="hide-on-med-and-down">
    <a class="btn-floating btn-large toc-color">
        <i class="fas fa-list-ul"></i>
    </a>
</div>


<script src="/blog/libs/tocbot/tocbot.min.js"></script>
<script>
    $(function () {
        tocbot.init({
            tocSelector: '#toc-content',
            contentSelector: '#articleContent',
            headingsOffset: -($(window).height() * 0.4 - 45),
            collapseDepth: Number('1'),
            headingSelector: 'h1,h2, h3, h4'
        });

        // modify the toc link href to support Chinese.
        let i = 0;
        let tocHeading = 'toc-heading-';
        $('#toc-content a').each(function () {
            $(this).attr('href', '#' + tocHeading + (++i));
        });

        // modify the heading title id to support Chinese.
        i = 0;
        $('#articleContent').children('h1,h2, h3, h4').each(function () {
            $(this).attr('id', tocHeading + (++i));
        });

        // Set scroll toc fixed.
        let tocHeight = parseInt($(window).height() * 0.4 - 64);
        let $tocWidget = $('.toc-widget');
        $(window).scroll(function () {
            let scroll = $(window).scrollTop();
            /* add post toc fixed. */
            if (scroll > tocHeight) {
                $tocWidget.addClass('toc-fixed');
            } else {
                $tocWidget.removeClass('toc-fixed');
            }
        });

        
        /* 修复文章卡片 div 的宽度. */
        let fixPostCardWidth = function (srcId, targetId) {
            let srcDiv = $('#' + srcId);
            if (srcDiv.length === 0) {
                return;
            }

            let w = srcDiv.width();
            if (w >= 450) {
                w = w + 21;
            } else if (w >= 350 && w < 450) {
                w = w + 18;
            } else if (w >= 300 && w < 350) {
                w = w + 16;
            } else {
                w = w + 14;
            }
            $('#' + targetId).width(w);
        };

        // 切换TOC目录展开收缩的相关操作.
        const expandedClass = 'expanded';
        let $tocAside = $('#toc-aside');
        let $mainContent = $('#main-content');
        $('#floating-toc-btn .btn-floating').click(function () {
            if ($tocAside.hasClass(expandedClass)) {
                $tocAside.removeClass(expandedClass).hide();
                $mainContent.removeClass('l9');
            } else {
                $tocAside.addClass(expandedClass).show();
                $mainContent.addClass('l9');
            }
            fixPostCardWidth('artDetail', 'prenext-posts');
        });
        
    });
</script>

    

</main>



    <footer class="page-footer bg-color">
    <div class="container row center-align" style="margin-bottom: 0px !important;">
        <div class="col s12 m8 l8 copy-right">
            Copyright&nbsp;&copy;
            <span id="year">2019</span>
            <a href="https://fei_chang_2.gitee.io" target="_blank">飞畅</a>
            |&nbsp;Powered by&nbsp;<a href="https://hexo.io/" target="_blank">Hexo</a>
            |&nbsp;Theme&nbsp;<a href="https://github.com/blinkfox/hexo-theme-matery" target="_blank">Matery</a>
            <br>
            
            &nbsp;<i class="fas fa-chart-area"></i>&nbsp;站点总字数:&nbsp;<span
                class="white-color">2.8k</span>&nbsp;字
            
            
            
            
            
            
            <span id="busuanzi_container_site_pv">
                |&nbsp;<i class="far fa-eye"></i>&nbsp;总访问量:&nbsp;<span id="busuanzi_value_site_pv"
                    class="white-color"></span>&nbsp;次
            </span>
            
            
            <span id="busuanzi_container_site_uv">
                |&nbsp;<i class="fas fa-users"></i>&nbsp;总访问人数:&nbsp;<span id="busuanzi_value_site_uv"
                    class="white-color"></span>&nbsp;人
            </span>
            
            <br>
            
            <br>
            
        </div>
        <div class="col s12 m4 l4 social-link social-statis">
    <a href="https://github.com/feichang2" class="tooltipped" target="_blank" data-tooltip="访问我的GitHub" data-position="top" data-delay="50">
        <i class="fab fa-github"></i>
    </a>



    <a href="mailto:3388172421@qq.com" class="tooltipped" target="_blank" data-tooltip="邮件联系我" data-position="top" data-delay="50">
        <i class="fas fa-envelope-open"></i>
    </a>







    <a href="tencent://AddContact/?fromId=50&fromSubId=1&subcmd=all&uin=3388172421" class="tooltipped" target="_blank" data-tooltip="QQ联系我: 3388172421" data-position="top" data-delay="50">
        <i class="fab fa-qq"></i>
    </a>







    <a href="/blog/atom.xml" class="tooltipped" target="_blank" data-tooltip="RSS 订阅" data-position="top" data-delay="50">
        <i class="fas fa-rss"></i>
    </a>

</div>
    </div>
</footer>

<div class="progress-bar"></div>


    <!-- 搜索遮罩框 -->
<div id="searchModal" class="modal">
    <div class="modal-content">
        <div class="search-header">
            <span class="title"><i class="fas fa-search"></i>&nbsp;&nbsp;搜索</span>
            <input type="search" id="searchInput" name="s" placeholder="请输入搜索的关键字"
                   class="search-input">
        </div>
        <div id="searchResult"></div>
    </div>
</div>

<script src="/blog/js/search.js"></script>
<script type="text/javascript">
$(function () {
    searchFunc("/blog/" + "search.xml", 'searchInput', 'searchResult');
});
</script>
    <!-- 回到顶部按钮 -->
<div id="backTop" class="top-scroll">
    <a class="btn-floating btn-large waves-effect waves-light" href="#!">
        <i class="fas fa-arrow-up"></i>
    </a>
</div>


    <script src="/blog/libs/materialize/materialize.min.js"></script>
    <script src="/blog/libs/masonry/masonry.pkgd.min.js"></script>
    <script src="/blog/libs/aos/aos.js"></script>
    <script src="/blog/libs/scrollprogress/scrollProgress.min.js"></script>
    <script src="/blog/libs/lightGallery/js/lightgallery-all.min.js"></script>
    <script src="/blog/js/matery.js"></script>

    <!-- Global site tag (gtag.js) - Google Analytics -->


    <!-- Baidu Analytics -->

    <!-- Baidu Push -->

<script>
    (function () {
        var bp = document.createElement('script');
        var curProtocol = window.location.protocol.split(':')[0];
        if (curProtocol === 'https') {
            bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
        } else {
            bp.src = 'http://push.zhanzhang.baidu.com/push.js';
        }
        var s = document.getElementsByTagName("script")[0];
        s.parentNode.insertBefore(bp, s);
    })();
</script>

    
    <script src="/blog/libs/others/clicklove.js" async="async"></script>
    
    
    <script async src="/blog/libs/others/busuanzi.pure.mini.js"></script>
    

    

    

    

    
    
    <script type="text/javascript" size="150" alpha='0.6'
        zIndex="-1" src="/blog/libs/background/ribbon-refresh.min.js" async="async"></script>
    

    
    <script type="text/javascript" src="/blog/libs/background/ribbon-dynamic.js" async="async"></script>
    
    
    
    <script src="/blog/libs/instantpage/instantpage.js" type="module"></script>
    

</body>

</html>
